CVE-2021-3605 - log back

CVE-2021-3605 edited at 27 Jun 2021 08:15:51
Description
- A heap-buffer overflow was found in the rleUncompress function of OpenEXR before version 2.5.0. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.
+ A heap-buffer overflow was found in the rleUncompress function of OpenEXR before version 2.4.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1970991
https://github.com/AcademySoftwareFoundation/openexr/pull/1036
https://github.com/AcademySoftwareFoundation/openexr/commit/25259a84827234a283f6f9db72978198c7a3f268
https://github.com/AcademySoftwareFoundation/openexr/pull/643
https://github.com/AcademySoftwareFoundation/openexr/commit/37750013830def57f19f3c3b7faaa9fc1dae81b3
+ https://github.com/AcademySoftwareFoundation/openexr/pull/659
+ https://github.com/AcademySoftwareFoundation/openexr/commit/e79d2296496a50826a15c667bf92bdc5a05518b4
CVE-2021-3605 edited at 27 Jun 2021 08:12:46
Description
- A heap-buffer overflow was found in the rleUncompress function of OpenEXR. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.
+ A heap-buffer overflow was found in the rleUncompress function of OpenEXR before version 2.5.0. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1970991
https://github.com/AcademySoftwareFoundation/openexr/pull/1036
https://github.com/AcademySoftwareFoundation/openexr/commit/25259a84827234a283f6f9db72978198c7a3f268
+ https://github.com/AcademySoftwareFoundation/openexr/pull/643
+ https://github.com/AcademySoftwareFoundation/openexr/commit/37750013830def57f19f3c3b7faaa9fc1dae81b3
CVE-2021-3605 edited at 16 Jun 2021 08:31:02
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Arbitrary code execution
Description
+ A heap-buffer overflow was found in the rleUncompress function of OpenEXR. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.
References
+ https://bugzilla.redhat.com/show_bug.cgi?id=1970991
+ https://github.com/AcademySoftwareFoundation/openexr/pull/1036
+ https://github.com/AcademySoftwareFoundation/openexr/commit/25259a84827234a283f6f9db72978198c7a3f268
CVE-2021-3605 created at 16 Jun 2021 08:30:00
Severity
+ Unknown
Remote
+ Unknown
Type
+ Unknown
Description
References
Notes